6mile

8 ms·

1.
PolinRider Is Coming(opensourcemalware.com)
2 points by 6mile 22d ago|0 comments
2.
Rubygem typosquat campaign deploys Windows stealer(opensourcemalware.com)
2 points by 6mile 1mo ago|0 comments
3.
North Korea NullReceiver Hides Malware in NPM(opensourcemalware.com)
2 points by 6mile 2mo ago|1 comments
4.
by 6mile 2mo ago
DPRK has created a new leaner technique to obfuscate its C2 payloads with NullReceiver. The NPM packages call the Ethereum blockchain directly to find hidden addresses in the destination.
5.
North Korean Hackers Compromise Go and PHP Packages(opensourcemalware.com)
11 points by 6mile 2mo ago|1 comments
6.
by 6mile 2mo ago
Because the Go and Packagist registries don't require additional publishing credentials like NPM and PyPI North Korean threat actors have been able to compromise legitimate packages via their PolinRider campaign.
7.
NPM attack targets Zapier and security tool browser extensions(opensourcemalware.com)
5 points by 6mile 3mo ago|1 comments
8.
by 6mile 3mo ago
NPM attack targeting Mastro targets browser extensions other than crypto wallets. - Credential managers and MFA authenticators from LastPass, Bitwarden, 1Password, Deloitte, Dashlane, ExpressVPN, KeePass, Proton, Kaspersky, passbolt, NordPa
9.
Microsoft Compromised Again. Shuts Down Azure Function GitHub Actions(opensourcemalware.com)
49 points by 6mile 3mo ago|2 comments
10.
by 6mile 3mo ago
Signs point to the Miasma worm, but this is unconfirmed yet.
11.
by 6mile 4mo ago
The same threat actor that compromised Axios published three additional NPM packages within 18 hours. Unfortunately, these packages are still alive on NPM and compromising victims.
12.
More live NPM packages attributed to Axios threat actors(opensourcemalware.com)
3 points by 6mile 4mo ago|1 comments
13.
Popular Kubernetes Networking Project Antrea Compromised(opensourcemalware.com)
3 points by 6mile 4mo ago|1 comments
14.
by 6mile 4mo ago
If you are a Kubernetes shop, you will want to check whether you are using the Antrea project. Nothing malicious has been deployed yet, as we caught this one early, but the threat actors compromised the Jenkins build servers, so we expect
15.
Popular Kubernetes Networking Project Antrea Compromised(opensourcemalware.com)
2 points by 6mile 5mo ago|0 comments
16.
Intercom-client NPM package and lightning PyPI packages compromised(opensourcemalware.com)
2 points by 6mile 5mo ago|1 comments
17.
Bitwarden CLI NPM package has been compromised(opensourcemalware.com)
16 points by 6mile 5mo ago|1 comments
18.
by 6mile 5mo ago
TeamPCP claims another victim and this time they call it "Shai-Hulud: The Third Coming"
19.
Vercel Incident Response Playbook(github.com)
7 points by 6mile 5mo ago|4 comments
20.
by 6mile 5mo ago
We have helped several orgs with incident response and this is the playbook that we used.
21.
by 6mile 6mo ago
The bash script for checking for infection? is that what you are talking about?
22.
GitHub Accounts Compromised(opensourcemalware.com)
13 points by 6mile 6mo ago|2 comments
23.
Neutralinojs developer framework compromised with malware(opensourcemalware.com)
1 points by 6mile 7mo ago|0 comments
24.
Malicious skills targeting Claude Code and Moltbot users(opensourcemalware.com)
181 points by 6mile 8mo ago|87 comments
25.
by 6mile 8mo ago
Hi, I'm one of the researchers that identified this threat and I blogged about it back in November ( https://opensourcemalware.com/blog/contagious-interview-vsco... ) First, @Tyriar thanks for being a part of this c
26.
by 6mile 8mo ago
This malware is a full-featured RAT that uses Telegram for C2 and is only 143 lines of code. It's "RAT-as-a-library" design means that we are already seeing criminals build more complext, customized malware on top of Scopper
27.
New Python "RAT-as-a-library" named "Scopper"(getsafety.com)
1 points by 6mile 8mo ago|1 comments
28.
VSCode Tasks files used in new malware campaign(opensourcemalware.com)
4 points by 6mile 10mo ago|0 comments
29.
Undelete NPM Packages(npmjs.com)
3 points by 6mile 11mo ago|1 comments
30.
by 6mile 11mo ago
The undelete package lets you recover NPM packages that have been removed and are no longer in the NPM registry. Works for both the tarballs and metadata. I use it for malware research, but you can use it for whatever you want!

More ›